Labs for Principles of Information Security 7th Edition by TBtutors

Type:

Test Bank

Resource:

Labs for Principles of Information Security

Edition:

7th Edition

Author(s):

Michael E. Whitman Herbert J. Mattord

Hands-On Lab: To accompany Whitman and Mattord, Principles of Information Security, 7th Ed., 2022, ISBN 978-0-357-506431; Ethical Considerations in IT and Detecting Phishing Attacks

Hands-On Lab: Ethical Considerations in IT and Detecting Phishing Attacks To accompany Whitman and Mattord, Principles of Information Security, 7th Ed., 2022, ISBN 978-0-357-50643-1; Ethical Considerations in IT and Detecting Phishing Attacks

Table of Contents Objective......................................................................................................................................... 2 Estimated Completion Time ......................................................................................................... 2 Materials Required ........................................................................................................................ 2 Introduction ................................................................................................................................... 2 Ethical Considerations in the Use of Information Security Tools .............................................. 3 Are You a White Hat? ................................................................................................................. 3 The White Hat Agreement ......................................................................................................... 4 (ISC)2 Code of Ethics ................................................................................................................... 5 Self-Reflection and Response ....................................................................................................... 7 Instructor’s Response ................................................................................................................ 7 Detecting and Responding to Phishing Attacks .......................................................................... 8 Legitimate Messages Don’t Request Sensitive Information ................................................... 8 Legitimate Messages Usually Call You by Your Name ........................................................ 9 Legitimate Messages Come from Authentic Domains ......................................................... 10 Legitimate Messages Come from People Who Know How to Spell and Write ................... 11 Legitimate Messages Don’t Force You to a Web Site ............................................................ 12 Legitimate Messages Don’t Include Unsolicited Attachments ............................................. 13 Legitimate Messages Have Links that Match Legitimate URLs ............................................ 13 Legitimate Messages Don’t Create an Artificial Sense of Urgency....................................... 14 Legitimate Messages Display Reliable Names....................................................................... 15 Legitimate Messages Don’t Solicit Money .............................................................................. 16 How You Should Respond to Phishing E-Mails ...................................................................... 18 Test Your Knowledge ........................................................................................................... 19 Instructor’s Response: ............................................................................................................. 26

Hands-On Lab: To accompany Whitman and Mattord, Principles of Information Security, 7th Ed., 2022, ISBN 978-0-357-506431; Ethical Considerations in IT and Detecting Phishing Attacks

Objective Upon completion of this activity, you will: • •

have a better understanding of the ethical expectations of IT professionals; and be able to identify several types of social engineering attacks that use phishing techniques.

Estimated Completion Time If you are prepared, you should be able to complete: • •

The Ethical Considerations lab in 15 to 20 minutes. The Phishing E-Mail lab in 60 to 75 minutes.

Materials Required Completion of this lab does not require any software to be installed and configured on your computer.

Introduction This module does not include a “hands-on” project to develop specific skills. Instead, it discusses two topics that will be useful for the projects you perform in the later modules. You will first learn about the ethical dimension of using information security tools and techniques that many consider to be from the “dark side.” Social engineering is a term to describe malicious actions that exploit human psychology to gain access to sensitive information or money. Attackers manipulate people through dishonest social interactions and exploit the human tendency to trust to gather valuable information. Phishing is a popular form of social engineering attack in which an attacker provides what appears to be a legitimate communication (usually e-mail), but it contains hidden or embedded code that redirects the reply to a third-party site to extract personal or confidential information. The best defense against e-mail phishing attacks is user awareness. Many organizations now filter employee e-mail using commercial products, but even the best of these products will not stop every phishing e-mail. Having an alert workforce and a trained service support staff are also required. In the second part of this lab, you will begin by reading about the indicators that an e-mail is actually a phishing attack. Next, you will assume the role of a help-desk analyst who is responding to alerts from users that have received suspicious e-mails. [return to top]

Hands-On Lab: To accompany Whitman and Mattord, Principles of Information Security, 7th Ed., 2022, ISBN 978-0-357-506431; Ethical Considerations in IT and Detecting Phishing Attacks

Ethical Considerations in the Use of Information Security Tools Using some of the “tools of the trade” in information security might lead students (and their instructors) to use software and techniques that are designed to break the rules and allow bad acts to occur. Because each academic community sets certain standards, you need to be aware of how they might apply in your specific circumstances. Conformance to standards and exhibiting ethical behavior is required to ensure the unhindered pursuit of knowledge and the free exchange of ideas. Academic integrity means that you respect the right of other individuals to express their views and opinions, and that you, as a student or faculty member, do not engage in plagiarism, cheating, illegal access, misuse or destruction of college property, or the falsification of college records or academic work. As a member of the academic community, and as a future InfoSec or IT professional, you are expected to adhere to standards of ethical behavior. You are expected to read and follow your institution’s code of conduct, which usually is found in your student handbook. You need to be aware that if you violate these standards, you will be subject to penalties outlined in your institution’s student conduct and academic integrity procedures. These penalties likely range from grade penalties to permanent expulsion. Your instructor may require you to read the white hat agreement and code of ethics that follow. Your instructor might also ask you to sign a form acknowledging that you agree to abide by these ethical standards while you are a student. Your agreement would indicate that you understand the ethical behavior expected of you as part of an academic community, and that you understand the consequences of violating those standards. For those of you in InfoSec or cybersecurity programs, the standard is even higher, given that you will be a guardian of an organization’s data in the future.

Are You a White Hat? As part of this course, you may be exposed to systems, tools, and techniques related to information security. With proper use, these components allow a security administrator or technician to better understand vulnerabilities and the security precautions used to defend an organization’s information assets. Misuse of these components, either intentionally or accidentally, can result in breaches of security, damage to data, or other undesirable results. Because the labs in this book will sometimes be carried out in a public network that is used by people for real work, you must agree to the following before you can participate. If you are unwilling to sign this agreement, your instructor may not allow you to participate in the projects.

Hands-On Lab: To accompany Whitman and Mattord, Principles of Information Security, 7th Ed., 2022, ISBN 978-0-357-506431; Ethical Considerations in IT and Detecting Phishing Attacks

The White Hat Agreement If you have questions about any of the following guidelines, please contact your instructor. This document may be changed from time to time by your instructor, who will notify you of such changes and may ask you to reaffirm your understanding and agreement. 1. Just because you can do something doesn’t mean you should. 2. As you engage in projects, you will be granted access to tools and training that have the potential to do harm even when they are used to determine or investigate the security of an information system. Use these tools with care and consideration of their impact, and only in the ways specified by your instructor. 3. If any question arises in your mind about whether you can or should perform an activity or use a tool in a particular way, stop and ask your instructor for clarification. In information security, it is most definitely NOT easier to ask for forgiveness than for permission. 4. You are only allowed to use the tools and exercises if you are currently registered for a grade in the course. An instructor always has the right to ask students for appropriate identification if necessary. 5. Any instance of suspected misconduct, any illegal or unauthorized use of tools or exercises, or any action construed as being outside the guidelines of the course syllabus and instruction will be investigated by the instructor and may result in severe academic and/or legal penalties. Being a student does not exempt you from consequences if you commit a crime. 6. All students are expected to follow the (ISC)2 code of ethics, which is available at www.isc2.org/ethics and included later in this document. 7. By acknowledging this agreement, you confirm that you will: •

Only perform the actions specified by the course instructor for using security tools on assigned systems.

•

Report any findings to the course instructor or in specified reporting formats without disclosing them to anyone else.

•

Maintain the confidentiality of any private information learned through course exercises.

•

Manage assigned course accounts and resources with the understanding that their contents may be viewed by others.

•

Hold harmless the course instructor and your academic institution for any consequences or actions if you use course content outside the physical or virtual confines of the specified laboratory or classroom.

Hands-On Lab: To accompany Whitman and Mattord, Principles of Information Security, 7th Ed., 2022, ISBN 978-0-357-506431; Ethical Considerations in IT and Detecting Phishing Attacks

•

Abide by the computing policies of your academic institution and by all laws governing the use of computer resources on campus.

8. By acknowledging this agreement, you confirm that you will not: •

Attempt to gain access to a system, attempt to increase privileges on any system, or access any data without proper authorization.

•

Disclose any information that you discover as a direct or indirect result of this course exercise.

•

Take actions that will modify or deny access to any system, data, or service except those to which administrative control has been delegated to you.

•

Attempt to perform any actions or use utilities presented in the laboratory outside the confines and structure of the projects or classroom.

•

Use any security vulnerabilities beyond the target accounts in the course or beyond the duration of the course exercise.

•

Pursue any legal action against the course instructor or the university for any consequences or actions if you use what you learn in the course outside the physical or virtual confines of the laboratory or classroom.

9. You will abide by the following code of ethics: Safety of the commonwealth, duty to our principles, and to each other requires that we adhere, and be seen to adhere, to the highest ethical standards of behavior.

(ISC)2 Code of Ethics Protect society, the common good, necessary public trust and confidence, and the infrastructure. •

Promote and preserve public trust and confidence in information and systems.

•

Promote the understanding and acceptance of prudent information security measures.

•

Preserve and strengthen the integrity of the public infrastructure.

•

Discourage unsafe practice.

Act honorably, honestly, justly, responsibly, and legally. •

Tell the truth; make all stakeholders aware of your actions on a timely basis.

•

Observe all contracts and agreements, express or implied.

•

Treat all constituents fairly. In resolving conflicts, consider public safety and duties to principles, individuals, and the profession in that order.

•

Give prudent advice; avoid raising unnecessary alarm or giving unwarranted comfort. Take care to be truthful, objective, cautious, and within your competence.

Hands-On Lab: To accompany Whitman and Mattord, Principles of Information Security, 7th Ed., 2022, ISBN 978-0-357-506431; Ethical Considerations in IT and Detecting Phishing Attacks

•

When resolving differing laws in different jurisdictions, give preference to the laws of the jurisdiction in which you render your service.

Provide diligent and competent service. •

Preserve the value of systems, applications, and information.

•

Respect the trust and privileges granted to you.

•

Avoid conflicts of interest or the appearance thereof.

•

Render only those services for which you are fully competent and qualified.

Advance and protect the profession. •

Sponsor for professional advancement those best qualified. All other things being equal, prefer those who are certified and who adhere to these canons.

•

Avoid professional association with those whose practices or reputation might diminish the profession.

•

Take care not to injure the reputation of other professionals through malice or indifference.

•

Maintain your competence; keep your skills and knowledge current. Give generously of your time and knowledge in training others.

The ISC2 code of ethics is available from www.isc2.org/ethics.